Hi, I was experimenting a bit with migrating from the use of pcap_offline_filter() to pcap_setfilter(). I was a bit surprised that installing for instance 500 pcap handlers with a BPF rule "arp" via pcap_setfilter() reduced the TCP performance of iperf3 over veth interfaces from 73.8 Gbits/sec to 5.39 Gbits/sec. Using only one or even five handlers seemed fine (71.7 Gbits/sec and 70.3 Gbits/sec). Is that expected? Full test setup description and more detailed results can be found here: https://github.com/lemoer/bpfcountd/pull/8 Regards, Linus PS: And I was also surprised that there seems to be a limit of only 510 pcap handlers on Linux.
